Breaking Windows for better security
Published: 21 Jun 2005 12:55 BST
As a result, Anderson and his team walked away with some concrete ideas on how to make sure future versions of Windows are more resilient to wireless attacks. He also left the room with a new respect for the hackers behind the demonstration.
"It's not just a bunch of disaffected teenagers sitting in their mother's basement," he said. "These are professionals that are thinking about these issues."
The hackers, for their part, seemed equally impressed with the technical knowledge of the senior executives they encountered.
At one point, researcher Matt Conover was talking about a fairly obscure type of problem called a heap overflow. When he asked the crowd, made up mostly of vice-presidents, whether they knew about this type of issue, 18 of 20 hands went up.
"I doubt that there is another large company on this planet that has that level of technical competency in management roles," Moore said.
Yet regardless of the mutual admiration, some tense moments were inevitable during the confrontation.
Microsoft developers, for instance, were visibly uncomfortable when Moore demonstrated Metasploit — a tool that system administrators can use to test the reliability of their systems to intrusion. But Metasploit also includes a fair number of exploits, as well as tools that can be used to develop new types of attacks.
"You had these developers saying, 'Why are you giving the world these tools that make it so easy to do exploitation?'" Kaminsky said. They calmed down, he said, once the researchers were able to state their case.
"We do regression testing in the real world of software development," Kaminsky said. "If we say, 'This thing isn't going to break,' then we need to test that. What these tools give is the ability to do this kind of testing, to be able to say not just, 'We did the best we could,' but 'We tried stuff and nothing worked.'"
Previous
Did you find this article useful?
258 out of 532 people found this useful
- Share this article:
Full Talkback thread
2 comments
